Skip to main content

KBA1543 Masking Engine requirements for DB2 on Mainframe zOS



With the Illium release of the Masking Engine, support for DB2 on the Mainframe/zOS has been re-instated using IBM's JDBC Type 4 Driver (db2jcc4.jar), which is re-distributed with the Masking Engine. However, a DB2 Connect license from IBM must be supplied by the customer in order for the Masking Engine to connect to DB2 on the Mainframe using this driver.

After the DB2 Connect license is activated for the Masking Engine, customers can use the "Mainframe DB2" connector to create DB2 on the Mainframe rulesets and run the following types of jobs against their rulesets:


  • Profiling

  • Masking In-Place (Batch Update and Bulk Data options available)

  • Masking On-the-Fly (Batch Update and Truncate options available)

  • Tokenization and Re-Identification

  • Certify

  • Provisioning by Masking Engine


If the Masking Engine fails to connect to DB2 on the Mainframe, a user should perform "Test Connection" from the "Mainframe DB2" connector screen:

If a message such as the following is displayed, this indicates that a DB2 Connect license has not been activated for the Masking Engine:


There are several editions of DB2 Connect that may be licensed by the user:

  • Personal Edition 
  • Enterprise Edition 
  • Application Server Edition
  • Unlimited Edition

Each of these editions appear to use one of two DB2 Connect licensing schemes: 

  1. IBM DB2 Connect Activation Package for unlocking the mainframe to client applications (e.g.,
  2. IBM DB2 Client license installed with the client application (db2jcc_license_cisuz.jar) 


If the customer uses a DB2 Connect Activation package and has not previously activated DB2 Connect for their client applications, then the Activation package needs to be extracted and executed on any customer system with TCP/IP connectivity to their mainframe.  For example, on a Linux system for a customer licensed  for DB2 Connect Unlimited Edition, they would:

  1. unzip 
  2. cd consv_zs/db2/license
  3. ./ -host <hostname> -port <portnumber> -database <dbname> -user <dbuser> -password <userpassword>
hostname = host running DB2 on the mainframe
portnumber = port number for DB2 on the mainframe
If the customer uses a DB2 Connect Client license, they must download and copy (using sudo) their db2jcc_license_cisuz.jar to the following locations on the Masking Engine:
  • /opt/delphix/dmsuite/tomcat/webapps/dmsuite/WEB-INF/lib (for the Masking Engine UI)
  • /opt/delphix/dmsuite/DMSApplicator/libext/JDBC (for Kettle job execution)